medium6.1
CVE-2021-39286
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Impact
Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webrecorder | Pywb | before 2.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/webrecorder/pywb/commit/f7bd84cdacdd665ff73ae8d09a202f60be2ebae9
- https://github.com/webrecorder/pywb/compare/v-2.5.0...v-2.6.0
- https://github.com/webrecorder/pywb/commit/f7bd84cdacdd665ff73ae8d09a202f60be2ebae9
- https://github.com/webrecorder/pywb/compare/v-2.5.0...v-2.6.0